CVE-2026-72676 Improper Control of Generation of Code in Fleet Server Leading to Code Injection
Attackers can execute arbitrary code by injecting script syntax into Kibana output configuration identifiers processed by Fleet Server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-72676?
CVE-2026-72676 is a medium-severity code injection vulnerability in Elastic Kibana, published on 13 Aug 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script content via Code Injection (CAPEC-242). Kibana accepted an identifier for an output configuration without restricting it to safe characters. That identifier is later placed into a server-side script that Fleet Server builds as part of routine agent policy processing, so script syntax embedded in the identifier became part of the script that was executed rather than being treated as data.
Weakness: CWE-94
Which versions are affected by CVE-2026-72676?
It affects 1 product.
Products include Elastic Kibana.
How do I fix CVE-2026-72676?
No fix has been published for CVE-2026-72676 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-72676 being exploited?
There is no known exploitation of CVE-2026-72676 in the wild and no public exploit code.
Other vulnerabilities in Elastic Kibana
Sources
Also known as GHSA-hfcx-p43w-9wvx.